A JSON Web Key is a JSON data structure that represents a cryptographic key.
A JSON Web Key (JWK) is a JavaScript Object Notation (JSON) data structure that represents a cryptographic key.
The specification for this structure is in RFC 7517.
Questions tagged [jwk]
218 questions
5
votes
1 answer
How to extract public and private key from RSA JWK?
I'm trying to sign some data with a JWK i've been provided with.
So far i've tried to do this with jwt.io, the header is
{ "alg" : "RS256", "typ" : "JWT" }
and the payload is
{ "iss" : "4@john" }
Now to sign this I need a public and a private key.…
Red-ER
- 173
- 2
- 11
4
votes
1 answer
How to convert JWK to PEM
This question is more generic rather than for a specific language, so I will explain my issue and what I have tried in pseudocode.
I am trying to generate a PEM public key from a JWK Set. The JWK includes the "e" (exponent) and the "n" (modulus)…
Generic Nerd
- 308
- 1
- 7
- 19
4
votes
0 answers
Trying to get a public key from a jwk in Java
I'm trying to verify the signature on a JWT from AzureAD in my API. The endpoint where I retrieve the public key is here: https://login.microsoftonline.com/common/discovery/keys
So far I've tried using the Auth0 library…
Drew Ingram
- 75
- 1
- 9
4
votes
0 answers
Support for JWT signing/encryption in spring-security-oauth2?
I'm implementing an OAuth2 Authorization Server using spring-security-oauth2. The server is configured to issue JWTs, which works fine so far.
Now I would like to sign the tokens. There is a lot of code and examples available that verifies tokens…
Michael
- 291
- 1
- 3
- 13
4
votes
1 answer
Obtain public key byte array from Json Web Key
I have a Json Web Key that contains public key information and I'd like to get the public key as byte array. My goal is to eventually derive ethereum address from it, using Keccak hash. I understand the process of getting the address from the public…
Tomislav Markovski
- 12,331
- 7
- 50
- 72
4
votes
1 answer
OIDC - What's to stop someone from spoofing a JWT access_token?
When you authenticate with an OIDC provider you get back an id token and if you specified scopes for an API you get back an access token so that client applications can make requests to protected resources on the end user's behalf. Typically the…
Rob L
- 3,073
- 6
- 31
- 61
4
votes
2 answers
How to Fingerprint a JWK?
Is there a standard, canonical method for creating a fingerprint (aka thumbprint) for a JWK?
From what I was reading it seems that the standard doesn't define how a kid should be specified, which I find odd. To me it makes the most since to have it…
coolaj86
- 74,004
- 20
- 105
- 125
3
votes
1 answer
Expose public JWK in Go
I am trying to expose a JWK's endpoint in Go, but it appears the way I am generating the modulus is not correct. What am I doing wrong?
Here is how I have generated my keys:
openssl genrsa -out private_key.pem 2048
And the public part:
openssl rsa…
Marc06210
- 126
- 1
- 8
3
votes
1 answer
WebCryptoApi: Cannot wrap&unwrap aes-gcm key into&from "jwk" format with "encrypt" and "decrypt" active
I'm generating a key for encrypting data, then wrap it using a master key and store it alongside the encrypted data. All is well when wrapping into raw format, but when wrapping as jwk I get the error DOMException: Data provided to an operation does…
Gamer2015
- 195
- 6
3
votes
1 answer
How to create a signed JWT token using python
Im using the jwcrypto library to create a signed JWT. The requirement is to produce a JWT signed by the private component of an RSA key. I took the steps below
Create JWK key pair
from jwcrypto import jwk,jwt
key = jwk.JWK.generate(
…
West
- 2,350
- 5
- 31
- 67
3
votes
1 answer
token verification failing using JWK/JWT for user authentication
I am trying to verify an idToken using a public key in python.
I first convert the JWK token to PEM but when I call the "decode" function, I see a "signature verification failed" exception. What am I missing?
# Long string goes here - this is the…
Darth.Vader
- 5,079
- 7
- 50
- 90
3
votes
2 answers
Jwt verification fails by Envoy
I have a Laravel(Lumen) Login API, which generates a JWT using HS256. Then I sent my bearer token to Envoy Gateway and get from Envoy
JWT verification fails
On official JWT decode site I could successfully decode and verify my bearer token. Here I…
zhannalytov
- 33
- 4
3
votes
2 answers
Unable to parse JWK in Java
I implemented a rest authorization server that returns the public-key for a given keyId in the JWK format using the com.nimbusds:nimbus-jose-jwt:9.13 package. The code looks something like this:
@RequestMapping(value = "/oauth2", produces =…
Bhushan
- 590
- 1
- 7
- 23
3
votes
0 answers
Managing Json Web Key Set in the cluster environment
I have implemented an authorization server (spring boot application) using the spring security framework. In the application startup, the RSA key pair is generated and the Json Web Key Set (jwks) is also initialized with a public key. This public…
Pranab
- 63
- 4
3
votes
2 answers
How to generate RSA public key using exponent (e) and modulus (n) to verify the signature of a json web token?
My goal is to verify my id_token in JSON Web Token (JWT) format using jsonwebtoken verify method, which requires a public key as the second argument. My web application is a node js application.
According to Ping ID's documentation, I am supposed to…
Zhen Ming Ng
- 63
- 4